How Do The Script Garbage Collectors Work?

UPDATE: This article was written in 2003. Since that time the JScript garbage collector has been completely rewritten so as to be more performant in general, to handle the larger working sets entailed by modern web applications that we had absolutely no idea were coming when we designed the JScript GC back in 1995, to be better at predicting when there is garbage that needs collecting, and to be better at handling circular references involving browser objects. I did not do any of that work; I haven't worked on the script team for almost a decade now. I do not know how the modern JScript GC works; I've had the architect describe the basics to me but I am not an expert on it. This article should be considered "for historical purposes only"; it does not reflect how JScript works today.

JScript and VBScript both are automatic storage languages. Unlike, say, C++, the script developer does not have to worry about explicitly allocating and freeing each chunk of memory used by the program. The internal device in the engine which takes care of this task for the developer is called the garbage collector.

Interestingly enough though, JScript and VBScript have completely different garbage collectors. Occasionally people ask me how the garbage collectors work and what the differences are.

JScript uses a nongenerational mark-and-sweep garbage collector. It works like this:

Every variable which is "in scope" is called a "scavenger". A scavenger may refer to a number, an object, a string, whatever. We maintain a list of scavengers -- variables are moved on to the scav list when they come into scope and off the scav list when they go out of scope.

Every now and then the garbage collector runs. First it puts a "mark" on every object, variable, string, etc – all the memory tracked by the GC. (JScript uses the VARIANT data structure internally and there are plenty of extra unused bits in that structure, so we just set one of them.)

Second, it clears the mark on the scavengers and the transitive closure of scavenger references. So if a scavenger object references a nonscavenger object then we clear the bits on the nonscavenger, and on everything that it refers to. (I am using the word "closure" in a different sense than in my earlier post.)

At this point we know that all the memory still marked is allocated memory which cannot be reached by any path from any in-scope variable. All of those objects are instructed to tear themselves down, which destroys any circular references.

Actually it is a little more complex than that, as we must worry about details like "what if freeing an item causes a message loop to run, which handles an event, which calls back into the script, which runs code, which triggers another garbage collection?" But those are just implementation details. (Incidentally, every JScript engine running on the same thread shares a GC, which complicates the story even further.)

You'll note that I hand-waved a bit there when I said "every now and then..." Actually what we do is keep track of the number of strings, objects and array slots allocated. We check the current tallies at the beginning of each statement, and when the numbers exceed certain thresholds we trigger a collection.

The benefits of this approach are numerous, but the principle benefit is that circular references are not leaked unless the circular reference involves an object not owned by JScript.

However, there are some down sides as well. Performance is potentially not good on large-working-set applications -- if you have an app where there are lots of long-term things in memory and lots of short-term objects being created and destroyed then the GC will run often and will have to walk the same network of long-term objects over and over again. That's not fast.

The opposite problem is that perhaps a GC will not run when you want one to. If you say "blah = null" then the memory owned by blah will not be released until the GC releases it. If blah is the sole remaining reference to a huge array or network of objects, you might want it to go away as soon as possible. Now, you can force the JScript garbage collector to run with the CollectGarbage() method, but I don't recommend it. The whole point of JScript having a GC is that you don't need to worry about object lifetime. If you do worry about it then you're probably using the wrong tool for the job.

VBScript, on the other hand, has a much simpler stack-based garbage collector. Scavengers are added to a stack when they come into scope, removed when they go out of scope, and any time an object is discarded it is immediately freed.

You might wonder why we didn't put a mark-and-sweep GC into VBScript. There are two reasons. First, VBScript did not have classes until version 5, but JScript had objects from day one; VBScript did not need a complex GC because there was no way to get circular references in the first place! Second, VBScript is supposed to be like VB6 where possible, and VB6 does not have a mark-n-sweep collector either.

The VBScript approach pretty much has the opposite pros and cons. It is fast, simple and predictable, but circular references of VBScript objects are not broken until the engine itself is shut down.

The CLR GC is also mark-n-sweep but it is generational – the more collections an object survives, the less often it is checked for life. This dramatically improves performance for large-working-set applications. Of course, the CLR GC was designed for industrial-grade applications, the JScript GC was designed for simple little web pages.

What happens when you have a web page, ASP page or WSH script with both VBScript and JScript? JScript and VBScript know nothing about each others garbage collection semantics. A VBScript program which gets a reference to a JScript object just sees another COM object. The same for a VBScript object passed to JScript. A circular reference between VBScript and JScript objects would not be broken and the memory would leak (until the engines were shut down). A noncircular reference will be freed when the object in question goes out of scope in both language (and the JS GC runs.)

"The benefits of this approach are numerous, but the principle benefit is that circular references are not leaked unless the circular reference involves an object not owned by JScript. "

Glad you mentioned this.

Hardcore DHTML developers (well actually pretty much only Erik Ardvison @ webfx.eae.net) realised this principle some time ago, and know the score regarding references to binded COM objects like Nodes inside web pages, or Microsoft.XMLHTTP etc. The favoured approach is having a class that gets the reference on demand so you never have to assign it to a variable. I guess there is some kind of caching thing going on behind the scenes with methods like Microsoft.DomDocument.getElementById because performance does not seem to get adversly affected.

Really? Why? Simple, small web pages and other small (10-100 line) script applications are the 95% usage case for JScript Classic. Why would the fact that we designed a language towards its 95% usage case be annoying?

Eric, we’ve coded an entire framework in JS to do as much work as possible in the client without having to postback to the server everytime. So our case doesn’t exactly fit in the "simple little web pages"… Do you know of something that can help us for example in tunning the GC… registry keys, anything?

JavaScript was *initially* designed exactly for "simple little web pages". Obviously, we are using JavaScript for far more complicated projects. We are using JavaScript for purposes that Java was originally designed for (at least with respect to the web) — safe, mobile code.

So, nobody *should* get offended by that statement, although some will, anyway.

In the article you mentioned "We check the current tallies at the beginning of each statement, and when the numbers exceed certain thresholds we trigger a collection". What is the threshold limit in IE for various versions of browsers and Windows OS?

The heuristics are we do a GC on the next statement after any one of the following limits are passed since the previous GC:

0x100 variables/temps/etc allocated

0x1000 array slots allocated

0x10000 bytes of strings allocated

The array slot heuristic was not present in all versions of JScript — we discovered that some ASP pages were producing ENORMOUS integer arrays over and over again and never triggering a collection because they were always assigned to the same variables and never allocating strings. But aside from that, the heuristic has been pretty much the same in all versions. As you can see it’s a pretty naive heuristic.

So what’s going to happen in IE7? It’s clear that JS is no longer a language for tiny webpages: people are building fully functional applications with it. JScript’s memory management performance is one of the bigger difficulties people face in making such apps run on IE6.

I’m sure you know that there are much better GC algorithms than mark-and-sweep, and just tweaking the heuristics could make life much better. Can we look forward to an improvement here?

Sorry, that heuristic is not naive, it’s just plain wrong. Allocation of particular types or slots does not predict garbage, and the magnitudes are wrong compared to the cost of GC’ing a large live object graph.

I agree with you that these heuristics are broken and have been for a long time. Unfortunately, it’s been out of my hands for some time now, and I cannot say whether the team that is taking over ownership of the legacy script code for future releases is going to do any work on the GC or not. They haven’t told me their plans.

For Vista/IE 7 (jscript 5.7) we did improve the heuristics for the JScript garbage collector. For some applications, the performance improvement is dramatic.

Here’s how it works:

The initial threshholds and items counted are the same, but for vars and slots, they double (up to a large maximum) each time a collection recovers less than 15% of the outstanding items. The collector thereby roughly sizes itself to an app’s working set as it it grows.

When a collection recovers more than 85% of the items, the counts are reset to the starting default.

The threshhold on total bytes in the SysAllocString string space does not adapt – just the vars and slots.

To trim memeory usage once the app has reached steady-state, a collection is also triggered every 10 seconds. For the timer-triggered collections, the threshholds are not changed.

I think this clarification would be useful. For example, if I knew that it was the literal theshold which was constantly being hit due to my code structure, I could look at optimizing code by setting the literals up as constants outside of my critical path/loop

Unfortunately, some of the things you’d change to reduce the number of times you hit the GC thresholds (like reducing short term variables/objects) have other performance impacts (like scope lookup) so it seems like it’s a bit of a balancing act – but all I’m saying is that it would be good to have accurate info before starting off down this path.

NOTE: I agree that JS developers really should not be trying to write code centered around GC performance especially due to the balancing act above, but the reality is that there are an ever increasing number of complex JS based web applications out there with IE 6 support requirements and it would be really beneficial to find out what impact code structure has – since it’s the only factor under the developers control.

First, if your array is so large that you feel that for performance reasons, you need to manage the memory yourself, then you are using the wrong programming language. You should be using a language like C that lets you have fine-grained control over memory management. So my advice in this case is "don’t worry about it". If JScript works for you for this problem then let JScript manage your memory.

Second, supposing that you still do wish to free up the memory for performance reasons, well, if it is a local variable then it will be collected when the local variable goes out of scope. So, don’t worry about it. If it is a global variable then… why are you using a global variable to store huge amounts of memory that you are processing temporary data with??? Stop doing that, use a more modular design to put this processing into a helper function, and let the script engine GC deal with scavenging the locals when they go out of scope. So again, my advice is "let the script engine manage your memory".

If that still doesn’t dissuade you: to let the GC know that an array is available for scavenging, all you need to do is remove the last live reference to the array. It doesn’t matter what the former live reference refers to afterwards, just so long as it isn’t the thing you’re trying to free. You can set it to null, zero, "your mother", whatever you want. null seems like a reasonable choice.

Of course, getting rid of the last live reference STILL doesn’t do a collection. You have to wait for the GC to run. If you need to force the GC to run, see point one. You are using the wrong language. If that still doesn’t dissuade you, call the collectGarbage method.

We are developing a large client side executing application using javascript. You are making it sound like it is just the nature of the beast and we shouldn’t use javascript. I would accept that, except Firefox performs extremely well with our application: about 6 to 10 times faster.

I don’t accept it is a limitation of javascript; it is a limitation of the javascript engine inside of IE. I appreciate the good info and we are auditing our IE 6 implementation to see if we can do anything.

"Javascript" is a trademark of Sun Microsystems and is the name of the implementation of ECMAScript created by Netscape and those who inherited their code.

I have never worked on or with Javascript, I have only rarely run a Javascript program. I know very little about it.

I write a blog about JScript, which is Microsoft’s implementation of the ECMAScript programming language. I know rather a lot about that.

Unless specifically otherwise noted, my comments are always about JScript, the Microsoft implementation of ECMAScript. They should not be construed to be about other third-party implementations which I have little experience with or knowledge of.

I am writing a little page that is probably badly coded and probably leaves all manner of global arrays in memory which would probably explain why IE grinds to a halt when I introduce 200ish div elements on the page…

@ Bill Robertson: 6 to 10 times faster ECMAScript implementation in Firefox might mean that its script engine was designed with different objectives than JScript in IE, i.e. designed to work not only "for simple little web pages", but "for industrial-grade applications" as well 🙂

If you are developing client-side re-usable scripting objects, sooner or later you will find yourself spotting out memory leaks. Chances are that your browser will suck memory like a sponge and you will hardly be able to find a reason why your lovely

@Mike U.: ECMAScript implementation in Firefox SHOULD be designed with different objectives, because Firefox extensions are written in ECMAScript too and I suppose they share the same garbage collector.

The garbage collector will release it, but of course div1 is also holding onto a reference to the closure. Only when all the references are gone will it go away. But we have a circular reference, so the reference will never go away. Therefore, memory leak.

In IE8: The garbage collector has been rewritten so that IE-owned objects participate in the garbage collection process. This should not leak anymore.

The garbage collector distribution includes a C string package that provides for fast concatenation and substring operations on long strings. A simple curses- and win32-based editor that represents the entire file as a cord is included as a sample application.

Eric your post was most useful… and don’t worry I’m not offended by the term "simple little web pages". I started a small project in ASP JScript about 8 years ago. Then I never knew the system would be so popular. I used ASP Jscript because the syntax was the same as the client site JavaScript, so it made sense to me. This was 8 years ago remember… so no C#, Visual Studio etc…

Anyway, the point is JScript is VERY bad at cleaning up after its self – in my opinion it very much should be up to you as a programmer to clean up after yourself. The CollectGarbage(); was exactly the trick I was looking for.

Our servers where almost always falling over with memory build-up. I could actually sit there and watch our servers build all the way up to about 1 gig… after that the server will slow down to a halt. The only fix this was to set the Recycle to about 120min. This cleared the pipes but did not fix the problem. Our clients kept getting logged out since the Recycle drops the sessions.

I know there were a number of things we could have done – however changing all the code to VB simply was not in budget. There are hundreds of thousands of lines of code and custom built client modules… simply an impossible task.

That was until I read this post. I simply added <% CollectGarbage(); %> to the last line of code in the last include. So basically once everything was completed and executed… clean-up! Wow. My jaw dropped as I saw the memory drop, drop, drop…

There have simply been no more problems since this! Look I’m pretty sure that we have quite a unique situation, but if anyone else is out there starching their heads about this problem. Try it, worked for me.

We’re trying to follow a specific API which does not copy and return an object but which sorts it (i.e., along with its keys) by reference–necessitating our deleting properties and then adding them back. I know iteration order is not guaranteed, but all major browsers seem to usually iterate via for…in starting with the first property added.

However, in IE, when such properties are deleted and then added back, they still go back into the same relative order as before.

I was wondering whether it were possible to force object properties to be truly deleted (i.e., so that a function can add back properties without them falling into the same relative position as before).

To give a simple example:

function reverseObj (obj) {

var keys = [], vals = [];

for (var p in obj) {

keys.push(p);

vals.push(obj[p]);

delete obj[p];

}

keys.reverse();

vals.reverse();

for (var i=0; i < keys.length; ++i) {

obj[keys[i]] = vals[i]; // In IE, adds back in same position as before; other browsers append to the end (the latter properties will show up last when iterating in a for…in loop in these other browsers)